Quantum cryptography is the use of principles from quantum mechanics to provide or strengthen cryptographic functions, most prominently secure key distribution. The best-known example is quantum key distribution, or QKD, in which two parties establish a shared secret key using quantum states and then use that key with conventional cryptographic algorithms to encrypt or authenticate information. The security properties arise from physical characteristics of quantum systems rather than solely from assumptions about the computational difficulty of mathematical problems.
Quantum states cannot generally be measured without disturbance, and unknown quantum states cannot be perfectly copied, providing mechanisms for detecting certain forms of interception. In a typical QKD protocol, a sender encodes information into quantum states and a receiver measures them. The participants subsequently communicate over an authenticated classical channel to compare selected measurement information, estimate an error rate and perform classical post-processing. If the observed conditions are compatible with an acceptable security bound, they can distil a secret key. Quantum cryptography is therefore not synonymous with quantum computers, and QKD is not itself an encryption algorithm for arbitrary messages. It is primarily a method for establishing cryptographic keys with security properties derived from quantum physics.
The BB84 protocol, introduced by Charles Bennett and Gilles Brassard in 1984, is the classic example of quantum key distribution. It uses two incompatible bases to encode quantum states. A sender randomly chooses states from the available bases, and the receiver randomly chooses a measurement basis. After transmission, they publicly compare which bases were used without revealing the corresponding bit values and retain compatible measurements.
An interceptor attempting to measure the states without knowing the correct basis introduces detectable disturbances because measurements in incompatible bases can alter the quantum state. The legitimate parties estimate the quantum bit error rate from a subset of their data. If the error level is acceptable, they perform information reconciliation to correct differences and privacy amplification to reduce any information an adversary might have obtained. Security proofs quantify the amount of secret information that can safely be extracted under specified assumptions. The protocol therefore combines quantum transmission with classical communication and classical information processing rather than replacing conventional cryptography altogether.
Another important protocol family uses entangled states. In entanglement-based QKD, correlated quantum particles are distributed to two parties, and the security analysis can involve tests of correlations that are incompatible with simple local hidden-variable descriptions. The Ekert 1991 protocol is a prominent example. Modern security theory can be formulated in device-independent or measurement-device-independent frameworks that attempt to reduce dependence on assumptions about particular hardware components.
Measurement-device-independent QKD, for example, is designed to remove certain detector-side vulnerabilities by changing the protocol architecture so that measurement devices need not be trusted in the same way as conventional implementations. Device-independent approaches can provide particularly strong conceptual security guarantees but generally impose demanding experimental requirements. This distinction demonstrates that “quantum cryptography” encompasses multiple protocol families rather than a single technique, and that the practical security of a system depends on its protocol, hardware, implementation and security model.
Quantum cryptography has important limitations. The laws of quantum mechanics do not automatically make a deployed QKD system secure against every attack. Real devices contain imperfections, side channels and implementation vulnerabilities that may not be covered by an idealised protocol proof. Sources of photons, optical components, detectors, timing systems and classical control equipment can all create security considerations.
QKD also requires an authenticated classical communication channel; without authentication, an attacker could potentially conduct a man-in-the-middle attack against the classical part of the protocol. Authentication therefore normally relies on conventional cryptographic mechanisms or previously shared authentication keys. QKD does not solve endpoint security, malware, compromised computers, poor access controls or social engineering. If a legitimate endpoint is compromised, a perfectly generated quantum key does not protect information exposed at that endpoint. These distinctions are important because quantum cryptography protects particular stages of a cryptographic system rather than replacing the complete security architecture of an organisation.
Quantum cryptography is often discussed in relation to the threat posed by future quantum computers to conventional public-key cryptography. Large fault-tolerant quantum computers could, under suitable conditions, use Shor's algorithm to attack widely used public-key systems based on integer factorisation or discrete logarithms. Quantum key distribution offers a different security model because its key-establishment mechanism is based on physical quantum properties. However, QKD requires specialised infrastructure and does not eliminate the need for post-quantum cryptography.
Post-quantum cryptographic algorithms are classical algorithms designed to resist known quantum attacks and can operate over conventional networks. QKD and post-quantum cryptography therefore represent different approaches to quantum-era security. QKD can offer information-theoretic security under its assumptions, while post-quantum cryptography aims for computational security against both classical and quantum adversaries. Organisations evaluating quantum-resistant security may consider algorithm migration, cryptographic inventories, hybrid approaches and, where appropriate, specialised quantum communication infrastructure.
The physical implementation of QKD commonly uses optical fibres or free-space optical links. Fibre-based systems are affected by attenuation, dispersion and other optical limitations, while free-space systems can be affected by atmospheric conditions, pointing errors and line-of-sight constraints. Quantum repeaters are a proposed technology for extending quantum communication over much greater distances by distributing entanglement and using quantum memories and entanglement-swapping operations.
Practical long-distance QKD can also use trusted relay architectures, in which intermediate nodes must be trusted because they may have access to key material. Satellite-based quantum communication has been investigated as another way of overcoming some terrestrial fibre-loss limitations. These engineering considerations mean that quantum cryptography is simultaneously a cryptographic discipline, a quantum-information problem and a communications-engineering problem.
The main benefit claimed for QKD is that eavesdropping can, in principle, be detected through measurable changes in quantum states, providing a security property that does not depend on an adversary lacking sufficient computational power. Its disadvantages include specialised hardware, limited transmission distance or key rates in many implementations, infrastructure costs, operational complexity and the need to secure classical authentication and endpoint systems.
QKD also does not directly provide message confidentiality unless the resulting keys are used with an appropriate encryption mechanism. One-time pads can provide information-theoretic confidentiality when keys are truly random, secret and at least as long as the messages, but practical deployment requires substantial key-management infrastructure. Conventional symmetric encryption can instead use quantum-generated keys while retaining its usual computational security characteristics. Consequently, the precise security benefit depends on the complete cryptographic design rather than the presence of a quantum channel alone.
Quantum cryptography is best understood as an area of quantum information science concerned with cryptographic tasks that exploit quantum phenomena. Quantum key distribution is its most mature and widely discussed application, but research also covers quantum digital signatures, quantum secret sharing, quantum coin-flipping and other protocols. The field has developed from theoretical protocols into laboratory demonstrations and specialised communication networks, while practical deployment continues to focus on closing the gap between ideal security proofs and real hardware.
Its terminology should be distinguished carefully: quantum cryptography is the broader field; QKD is a particular class of quantum cryptographic protocol; quantum communication concerns transmission and processing of quantum information more generally; and post-quantum cryptography uses classical computational methods designed to resist quantum attacks. The central significance of quantum cryptography is that it demonstrates how physical laws can form part of a cryptographic security model, while also showing that secure communications require careful integration of quantum hardware, classical cryptography, authentication, implementation security and operational controls.
